Geolocation services: what's good, what's not?

[Peter Corlett]

On Wed, Dec 03, 2014 at 12:49:17AM +0000, Sam Kington wrote:
> The new EU VAT rules require us to work out where a customer is so we can
> charge the right VAT rate.
> https://www.gov.uk/government/publications/vat-supplying-digital-services-and-the-vat-mini-one-stop-shop/vat-supplying-digital-services-and-the-vat-mini-one-stop-shop

Not quite.  They require you to collect at least two pieces of *evidence* of
where a customer is, not incontrovertible proof.

> The customer's billing address is obvious, and we can get the issuing bank
> and country from our credit card supplier if they don't do something stupid
> and pay with an American Express card. What about IP addresses, though? What
> do people currently use for geolocation?

I'd just use any plausible free GeoIP database I could blag a copy of, or even
just query whois.ripe.net and parse out the country: field.  Unless you're
wilfully negligent, this should be sufficient.  It already sounds like you're
going way beyond the minimum level of checks acceptable, so I wouldn't worry
too much.